Description

telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw message content directly to v-html without HTML escaping or sanitization, enabling stored, cross-user, zero-click execution of injected payloads such as image onerror handlers when victims browse or search messages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-11T20:18:46.173Z",
  "pubdate": "2026-08-11T20:18:46.173Z",
  "executiveSummary": "The telegram-search application suffers from a stored cross-site scripting (XSS) vulnerability that enables remote attackers to execute arbitrary JavaScript in the browsers of victim users. The flaw stems from the handling of user-supplied message content within shared Telegram groups, which is rendered without proper HTML escaping or sanitization. This allows malicious actors to propagate crafted messages containing injected payloads across the system. The impact of this vulnerability is severe, as it facilitates cross-user, zero-click execution of malicious code, such as event handlers triggered automatically when victims browse or search through message archives. Attackers require no prior authentication to the underlying search application beyond the ability to send messages into the monitored Telegram group, effectively lowering the barrier for exploitation. The risk implications include potential session hijacking, data exfiltration, and unauthorized actions performed within the context of the victim's session. Remediation requires implementing robust input sanitization and context-aware output encoding before rendering user-generated content in the user interface.",
  "technicalDetails": "The vulnerability resides in the highlightKeyword function located within the MessageList.vue component of telegram-search. The root cause of the security defect is the direct passing of raw, unescaped message content directly into the v-html directive without prior sanitization or encoding. Because the application ingests messages from a shared Telegram group and subsequently indexes and displays them to various users searching the archive, any malicious HTML or JavaScript injected into a message string is treated as executable markup by the rendering engine.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious message containing an embedded script or HTML snippet equipped with malicious event handlers, such as an image tag utilizing the onerror attribute (e.g., <img src=x onerror=malicious_code>). Second, the attacker transmits this crafted payload into the shared Telegram group monitored by the telegram-search application. Third, the application ingests, stores, and indexes the message. Fourth, when a victim user navigates to the application, browses the message history, or performs a search query that invokes the MessageList.vue component, the highlightKeyword function processes the raw message string.\nBecause the vulnerable component utilizes v-html without sanitization, the browser interprets the injected payload upon rendering or when the event condition is met (such as the failure to load the invalid image source in an onerror handler). This results in zero-click execution of arbitrary JavaScript in the victim's browser session. The execution occurs within the security context of the victim, inheriting their session privileges and access rights to the telegram-search interface. Post-exploitation impact encompasses full DOM access, capability to read sensitive data displayed in the application, and potential interaction with underlying APIs on behalf of the authenticated victim."
}